f9615a5d42758c722a5ec459d8e162d9ecdc0e0f7878c1a513bcaccc9bf13b4e

Analysis

max time kernel
1s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs
Size 401B
Sample260919-m1rcpsed48
SHA256 f9615a5d42758c722a5ec459d8e162d9ecdc0e0f7878c1a513bcaccc9bf13b4e
MD5 8e4f4dfb8f3223acd53a2a8331db5cdb
SHA1 8706688aeaf295699f5adcd63225beaec6c035c8
SHA512 bd44d0c55dad3dfe1986c5560b87a87663ddade2df11292e70e2c36fb753639db467e601de7168b69746919d95f84138873bd6b17a5f562dfe89cc92919b6969
TLSH
T10BE061160E0DC02AD19DE046077BC91F9374F21934C1DF1083C59C91B11698F4C352A6
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\53397 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\29378 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\581920 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\902100 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\258397 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\362346 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\822002 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\865793 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\127614 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\946636 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\876257 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34450 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\330146 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\734809 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\409769 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\743374 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\101260 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\499318 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\13707 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
19376	WScript.exe
28972	WScript.exe
38352	Process not Found
55172	Process not Found
9316	WScript.exe
44572	WScript.exe
34560	Process not Found
6468	Process not Found
17560	Process not Found
28832	Process not Found
43044	Process not Found
17052	WScript.exe
24264	WScript.exe
26044	WScript.exe
26656	WScript.exe
7408	WScript.exe
42816	WScript.exe
49308	Process not Found
6108	Process not Found
32276	WScript.exe
40524	WScript.exe
4168	WScript.exe
1992	Process not Found
32448	Process not Found
59484	Process not Found
44856	Process not Found
5304	Process not Found
20220	WScript.exe
20476	WScript.exe
29236	WScript.exe
37668	WScript.exe
47444	Process not Found
41548	Process not Found
58516	Process not Found
51840	Process not Found
26316	WScript.exe
39752	WScript.exe
48144	WScript.exe
30548	Process not Found
31904	Process not Found
6172	WScript.exe
18836	WScript.exe
24640	WScript.exe
25668	WScript.exe
11556	WScript.exe
28104	WScript.exe
51964	Process not Found
45136	Process not Found
14516	WScript.exe
19712	WScript.exe
31044	WScript.exe
41656	WScript.exe
35208	Process not Found
52900	Process not Found
29424	Process not Found
54244	Process not Found
4468	WScript.exe
2956	WScript.exe
6352	WScript.exe
7256	WScript.exe
20396	WScript.exe
26016	WScript.exe
42856	WScript.exe
5372	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	WScript.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3160	3896	WScript.exe	89
PID 3896 wrote to memory of 1904	3896	WScript.exe	90
PID 3896 wrote to memory of 5800	3896	WScript.exe	91
PID 3896 wrote to memory of 1364	3896	WScript.exe	92
PID 3160 wrote to memory of 500	3160	WScript.exe	93
PID 3896 wrote to memory of 2228	3896	WScript.exe	94
PID 1904 wrote to memory of 1216	1904	WScript.exe	96
PID 3896 wrote to memory of 3120	3896	WScript.exe	97
PID 3160 wrote to memory of 4748	3160	WScript.exe	98
PID 1904 wrote to memory of 4672	1904	WScript.exe	99
PID 5800 wrote to memory of 2364	5800	WScript.exe	100
PID 1364 wrote to memory of 5580	1364	WScript.exe	101
PID 3896 wrote to memory of 6012	3896	WScript.exe	102
PID 3160 wrote to memory of 5620	3160	WScript.exe	103
PID 1904 wrote to memory of 3472	1904	WScript.exe	104
PID 5800 wrote to memory of 2640	5800	WScript.exe	105
PID 1364 wrote to memory of 1876	1364	WScript.exe	106
PID 3896 wrote to memory of 1448	3896	WScript.exe	107
PID 500 wrote to memory of 3104	500	WScript.exe	108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:500
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:3104
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:6308
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:12152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:31684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:47312
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:17284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:38564
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25288
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:38132
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:7332
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:17060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:37756
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:24444
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:37280
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:8436
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:23160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:47840
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:22672
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10848
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25916
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39812
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14364
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:5148
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:19376
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:13836
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12404
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43016
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:1480
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:7672
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:22056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:44572
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32992
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32168
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:8784
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25804
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39624
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11120
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32464
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48916
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16048
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:35212
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22236
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:45112
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33796
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:3828
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9144
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:23168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:47892
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:6792
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12684
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:31196
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:46524
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17648
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39644
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26260
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39908
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:2184
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10504
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:24940
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:38088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14192
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:32276
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48616
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18844
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42468
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28176
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:42056
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16552
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:35192
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22956
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:46164
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:35292
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8228
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:24996
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:2052
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:9316
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:24404
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37396
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12320
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31244
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:46200
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17332
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:25584
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:38436
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:4748
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:4508
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:7232
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:18380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:41408
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:26836
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:41012
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:8256
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:23100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:46852
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:35720
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10368
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:17112
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:37472
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14152
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32024
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48136
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19140
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:14008
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18452
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17812
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:1708
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9464
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:26524
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:40404
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13364
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:31568
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:47132
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17980
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:40772
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26356
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:39752
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6208
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10136
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:27784
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42096
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14036
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32284
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48152
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18552
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:40752
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:27572
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14160
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7172
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16604
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:36332
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22808
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:45804
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:35020
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8236
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:26656
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13224
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10156
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:3484
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:41900
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14944
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:34020
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:20196
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:42644
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:30708
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:30208
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:5620
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6072
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9584
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:24092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:27828
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:36604
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13940
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32008
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:27656
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18472
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:13564
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:27708
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:41956
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6172
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10612
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25148
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:18492
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13892
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32076
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:27792
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13952
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42652
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28704
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43696
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7104
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16644
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:17920
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22944
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:46248
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:35164
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8164
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:21424
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:21320
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31676
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:47532
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9480
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:23436
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48220
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7408
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:13552
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32260
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:48144
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18264
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39996
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26644
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26388
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:5960
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6592
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16796
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:36932
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16596
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48072
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36056
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7740
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:21336
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:21108
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31620
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:47244
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8848
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26512
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40220
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11352
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31000
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:45836
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16524
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:35728
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22624
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:45772
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:34876
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2956
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7680
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:20180
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42776
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44612
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8804
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:27396
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:41884
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7056
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31020
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:45828
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16480
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36492
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22892
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:46860
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:35148
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:4772
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10628
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25028
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:38176
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12800
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31452
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:3128
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12280
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:38968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:25932
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11624
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6532
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16672
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36356
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:23020
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:46868
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:35488
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7700
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:21404
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43072
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:31804
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4168
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8856
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17500
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12148
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:11372
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:29212
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:43516
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:16488
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:36340
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:22572
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:45240
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:34680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:1216
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:5464
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7256
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:17188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:39204
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:24728
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:37668
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:8264
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:27184
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:41784
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9516
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:24256
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:32452
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:36916
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14816
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:33316
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:49172
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:20152
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:20728
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30328
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44620
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:4156
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9080
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:23396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:27212
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:35772
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12544
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:31236
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:46404
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17600
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39476
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26024
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12472
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6180
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11248
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:29172
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:43668
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16496
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:35916
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10360
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:45780
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:34384
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7124
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:8972
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39280
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25704
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11932
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6428
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26584
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40200
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9328
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22404
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:45100
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:34368
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12944
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31440
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:46988
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17784
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11804
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26332
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:4672
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:3956
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:7940
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:22088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:21868
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:33608
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:49156
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:8832
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:26984
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:26844
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12696
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:31468
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25840
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17860
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:26372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26324
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25948
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:4664
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9472
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:11556
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:40420
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13376
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:31480
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:47120
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18220
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39672
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26412
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13268
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6432
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16856
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:9500
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16736
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:47876
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36192
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7488
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19392
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:13956
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18708
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43060
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8660
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:41452
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10912
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17324
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40572
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14312
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32488
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11444
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:19248
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:42436
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18564
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:43160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:3472
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:5052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9936
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25816
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39232
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14852
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:34012
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19896
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:14024
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:29604
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43936
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6420
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16564
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:36384
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22644
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:22544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:34852
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7560
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:20260
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:17196
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30528
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:21680
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8792
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:29996
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44256
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11508
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30156
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44628
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17176
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:38288
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24484
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:49288
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37272
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4468
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6936
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17516
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:11088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:26016
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39256
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22024
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:44100
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33276
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28848
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9308
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:23184
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48212
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:6452
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12936
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31212
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:46588
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17660
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39104
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26100
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:39852
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:3636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7220
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:20172
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42704
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30432
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44652
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8244
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:24808
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37876
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8204
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:24552
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37288
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:13960
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32436
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:48828
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18524
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40824
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:27536
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:41764
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:4144
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8996
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26056
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39832
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12272
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33232
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28036
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17216
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11028
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24676
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37844
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6272
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12160
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31228
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:46672
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17540
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40176
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:25996
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:39268
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7340
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:20236
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18316
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:30476
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:44644
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8548
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24512
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37388
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:10856
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:26044
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:19300
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:14992
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:34468
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:20476
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42948
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:30872
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:30648
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:2364
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:3844
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10492
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:24568
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:37436
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14428
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:33240
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:28660
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19828
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42520
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9576
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44000
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6500
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:14516
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32600
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48976
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19688
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42664
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:28972
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43280
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7660
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:20220
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:27964
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30572
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44604
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8816
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26688
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9420
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12176
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33208
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:29756
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17244
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37764
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24816
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37852
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:2640
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:2424
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10488
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25112
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:18180
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14272
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:32524
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:49116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19268
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42492
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28564
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43052
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6772
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11708
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39440
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25940
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39112
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7844
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:20424
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:28164
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30940
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:45556
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:27528
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:41928
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11528
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30080
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44596
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36992
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:23692
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:48544
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:36284
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:5932
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:1608
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17484
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:26384
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:26316
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19288
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6192
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:21436
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:43560
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31908
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:47564
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9508
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:23556
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:48512
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36208
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14296
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32112
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:27760
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:19080
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:15908
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:28576
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:700
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8368
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:24524
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37420
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10864
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12892
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40284
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14972
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:34248
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:20456
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:42848
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:30900
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:45224
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:2592
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10144
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25844
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39900
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:13976
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32064
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:1588
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18440
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40844
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:27468
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:41600
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6988
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18344
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40808
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26804
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8104
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44820
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:33700
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:49192
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:9492
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:28168
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42304
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:13716
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:31628
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:47228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:18208
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:39664
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:26348
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:12648
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:5580
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9300
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:23152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        7⤵
        
        PID:46876
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:35780
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12504
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:31044
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:45796
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17428
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:39636
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25688
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11888
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6296
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12328
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:31056
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:45820
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17356
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:38552
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12868
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:38424
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7432
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18412
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:40780
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26812
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40996
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8644
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17656
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40236
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11316
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30144
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44588
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17096
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9604
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24276
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28216
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:36924
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:1876
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6360
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14464
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:33096
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:28792
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19888
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42532
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:29616
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43896
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7380
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11396
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:11012
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:25668
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25236
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8476
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22072
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:44564
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33528
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28616
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10904
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44556
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:15168
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:34768
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:20592
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:42788
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:31032
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:45812
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:3508
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:1704
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17040
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:38812
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:23956
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:49024
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36528
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:6932
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26504
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40156
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9524
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:28104
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:42696
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14804
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33028
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:23868
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:20104
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:42864
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:29888
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:44048
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8060
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:22032
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:44580
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33564
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:49184
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8840
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11844
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26424
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8492
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:29764
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43952
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36268
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22728
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:45316
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:35036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:2656
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9872
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:24640
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37832
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14340
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32140
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:48160
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:19712
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:16032
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:28816
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:43364
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6948
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16588
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36460
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22964
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:46096
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:35252
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6568
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:23880
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:48584
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:36368
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:9456
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26540
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:40120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:12788
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:31460
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:47100
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:17420
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:38020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:25648
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8172
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:2228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:4796
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6352
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:10828
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:25324
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:38208
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:14352
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:33060
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:27688
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19792
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:42540
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:2024
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43964
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7420
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:17492
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:26132
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26308
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19260
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8636
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26552
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40540
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11428
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30552
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:30380
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17104
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37788
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24416
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37184
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:5840
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:492
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:21484
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:43108
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31800
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:25832
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8976
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:27104
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:41352
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12304
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32084
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:27940
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17316
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:11784
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:25592
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:924
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9572
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:29564
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43928
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:13900
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32472
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:48928
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:19228
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26824
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:28536
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42832
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6924
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11536
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39596
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:25768
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12028
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8088
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14980
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:18488
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:20256
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:47916
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8876
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18228
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:40484
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:11360
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:29236
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:43708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:16504
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:35996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:22588
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:45232
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:34792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:3120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:3440
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7800
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:19304
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        6⤵
        
        PID:15680
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:28748
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:43380
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:8864
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12264
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:37496
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11384
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:32456
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:48996
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16536
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:35952
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22664
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:45900
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:2068
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:5564
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9676
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:24988
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:24744
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:13884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31776
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:48876
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18712
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:13708
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:28132
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6560
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16580
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:36244
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22704
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:45908
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:34992
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7716
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22040
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44808
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:33508
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:49164
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8892
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:28144
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42316
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:11700
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:30504
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:44636
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:17052
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:24264
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24240
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7404
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:6012
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:3212
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:10584
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:26532
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:40524
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:14072
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:31824
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:12076
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:18688
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:40868
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:27956
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42000
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6728
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:9608
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39192
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:25792
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:38976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7792
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:20164
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:42816
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:30600
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:44668
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8824
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24848
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:12212
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:31220
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:46208
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:17200
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37780
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:24788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:37868
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:1448
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:6340
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:12168
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:33264
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:49244
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17232
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:9924
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24736
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37720
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7372
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:17388
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:39364
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:25636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:11596
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8468
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:27116
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:41756
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:10376
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:26876
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:41344
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:14044
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:31784
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:4824
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:18836
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:42476
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:28408
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:42548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:4768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7836
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22064
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44800
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:33500
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:29708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:9004
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:27700
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:41992
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:12184
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:33764
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:17636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:39020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:26120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:39860
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:5944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:7820
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:22048
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
        5⤵
        
        PID:44828
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:16312
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8904
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:24928
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37884
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:8488
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:33176
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:28920
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:16456
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:7368
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:4844
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:45128
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:34420
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:4660
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:10204
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:29188
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:43644
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:13968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:31656
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:47592
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:18624
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:41648
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:27632
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:41656
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:6692
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:16816
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:37216
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:11792
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:48080
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:36040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:8004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:20396
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:42856
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:30852
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:21744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:8940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:27520
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:13844
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:8412
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:32496
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:49060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:16424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:35240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:22556
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:45884
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:34568

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
1⤵
PID:3708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:9944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:23140
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
      4⤵
      PID:46256
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:35712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:13496
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:31204
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:22524
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:18016
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
    3⤵
    PID:39944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:26364
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e4f4dfb8f3223acd53a2a8331db5cdb.vbs"
  2⤵
  PID:12760